From: dreadfulbunny <dreadfulbunny@proton.me>
To: jlcusinato@neverhack.com
Cc: pve-devel@lists.proxmox.com, felix@ranovus.com, crandler@crandland.de
Subject: Re: [PATCH 0/3] fix #7864: allow pool-scoped privileges to create VMs with tags
Date: Tue, 03 Nov 2026 09:45:58 +0000 [thread overview]
Message-ID: <20261103094532.8686-1-dreadfulbunny@proton.me> (raw)
In-Reply-To: <20261027103626.767361-1-jlcusinato@neverhack.com>
Tested the whole series on a Proxmox VE 9.2 node: pve-manager 9.2.21,
libpve-guest-common-perl 6.0.5, qemu-server 9.2.11, pve-container 6.1.14.
I applied the three patches to the installed Perl modules (they apply
with offsets, no fuzz) and restarted pvedaemon and pveproxy; no rebuilt
packages.
Setup: a pool and an API token (privsep=1). The user and the token both
hold only a role with VM.Allocate, VM.Config.* and VM.Audit on
/pool/<pool>, plus PVEDatastoreUser on the rootfs storage and PVEAuditor
on the template storage. Nothing on /vms.
Before the patches:
- POST /nodes/<node>/qemu with pool and tags: the task fails with
"unable to create VM 210 - 403 Permission check failed (/vms/210,
VM.Config.Options)".
- POST /nodes/<node>/lxc with pool and tags: the API call itself
returns "403 Permission check failed (/vms/211, VM.Config.Options)".
- The same container create without tags succeeds.
With the patches:
- Both creates succeed; the guests have the tags and are pool members.
- Setting tags on an existing pool container (PUT
/nodes/<node>/lxc/<vmid>/config) still works.
Not tested: the {} -> '' change in qemu-server, since tag-style
user-allow is at its default ('free') here.
Tested-by: dreadfulbunny <dreadfulbunny@proton.me>
prev parent reply other threads:[~2026-11-03 12:29 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-27 10:32 [PATCH 0/3] fix #7864: allow pool-scoped privileges to create VMs with tags jlcusinato
2026-10-27 10:32 ` [PATCH pve-guest-common] fix #7864: guest helpers: allow pool-scoped privileges for tag permission checks jlcusinato
2026-10-27 10:32 ` [PATCH qemu-server] fix #7864: api: create vm: honour pool privileges when setting tags jlcusinato
2026-10-27 10:32 ` [PATCH pve-container] fix #7864: lxc: honour pool privileges when creating containers with tags jlcusinato
2026-11-03 9:45 ` dreadfulbunny [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261103094532.8686-1-dreadfulbunny@proton.me \
--to=dreadfulbunny@proton.me \
--cc=crandler@crandland.de \
--cc=felix@ranovus.com \
--cc=jlcusinato@neverhack.com \
--cc=pve-devel@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.